Government and state-owned organizations in a number of Asian countries have been targeted by a distinct group of espionage hackers as part of an intelligence gathering mission that has been underway since early 2021.
“A notable feature of these attacks is that the attackers leveraged a wide range of legitimate software packages in order to load their malware payloads using a technique known as DLL side-loading,” the Symantec Threat Hunter team, part of Broadcom Software, said in a report shared with The Hacker News.
The campaign is said to be exclusively geared towards government institutions related to finance, aerospace, and defense, as well as state-owned media, IT, and telecom firms.
Dynamic-link library (DLL) side-loading is a popular cyberattack method that leverages how Microsoft Windows applications handle DLL files. In these intrusions, a spoofed malicious DLL is planted in the Windows Side-by-Side (WinSxS) directory so that the operating system loads it instead of the legitimate file.
The attacks entail the use of old and outdated versions of security solutions, graphics software, and web browsers that are bound to lack mitigations for DLL side-loading, using them as a conduit to load arbitrary shellcode designed to execute additional payloads.
Furthermore, the software packages also double up as a means to deliver tools to facilitate credential theft and lateral movement across the compromised network.
“[The threat actor] leveraged PsExec to run old versions of legitimate software which were then used to load additional malware tools such as off-the-shelf remote access Trojans (RATS) via DLL side-loading on other computers on the networks,” the researchers noted.
In one of the attacks against a government-owned organization in the education sector in Asia lasted from April to July 2022, during which the adversary accessed machines hosting databases and emails, before accessing the domain controller.
The intrusion also made use of an 11-year-old version of Bitdefender Crash Handler (“javac.exe”) to launch a renamed version of Mimikatz (“calc.exe”), an open source Golang penetration testing framework called LadonGo, and other custom payloads on multiple hosts.
One among them is a previously undocumented, feature-rich information stealer that’s capable of logging keystrokes, capturing screenshots, connecting to and querying SQL databases, downloading files, and stealing clipboard data.
Also put to use in the attack is a publicly-available intranet scanning tool named Fscan to perform exploit attempts leveraging the ProxyLogon Microsoft Exchange Server vulnerabilities.
The identity of the threat group is unclear, although it’s said to have used ShadowPad in prior campaigns, a modular backdoor that’s fashioned as a successor to PlugX (aka Korplug) and shared among many a Chinese threat actor.
Symantec said it has limited evidence linking the threat actor’s earlier attacks involving the PlugX malware to other Chinese hacking groups such as APT41 (aka Wicked Panda) and Mustang Panda. What’s more, the use of a legitimate Bitdefender file to sideload shellcode has been observed in previous attacks attributed to APT41.
“The use of legitimate applications to facilitate DLL side-loading appears to be a growing trend among espionage actors operating in the region,” the researchers said. “Although a well-known technique, it must be yielding some success for attackers given its current popularity.”